Arbitrary File Deletion

october/october is vulnerable to arbitrary file deletion. The vulnerability exists as the returned value of getFilePath does not validate the real path of the file, allowing an authenticated user with the cms.manageassets permission to delete files outside the assets directory...